paypal-account.xyz Open in urlscan Pro
5.188.33.171  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response paypal-account.xyz/	689 B 842 B	624ms 176ms	Document text/html	5.188.33.171 GHOST
General Check archive.org Show headers Download Go to Full URL https://paypal-account.xyz/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 5.188.33.171 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS facai001.example.com Software nginx / Resource Hash b95ed0220d3d50675218aebd526741313505e9127094f37c8f52fa08d432c8b0 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes content-length 689 content-type text/html date Mon, 18 Apr 2022 21:22:41 GMT etag "625d810d-2b1" last-modified Mon, 18 Apr 2022 15:17:33 GMT server nginx strict-transport-security max-age=31536000
GET H2	200	app.206b3c99bcd0e426f21e8bd04b1cc7c8.css paypal-account.xyz/static/css/	738 KB 137 KB	354ms 353ms	Stylesheet text/css	5.188.33.171 GHOST
General Check archive.org Show headers Download Go to Full URL https://paypal-account.xyz/static/css/app.206b3c99bcd0e426f21e8bd04b1cc7c8.css Requested by Host: paypal-account.xyz URL: https://paypal-account.xyz/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 5.188.33.171 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS facai001.example.com Software nginx / Resource Hash d7fc2646d7a225ffe9c349f949afcdc7f45dc2fa75d50265314e85c7828d3ee0 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://paypal-account.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers date Mon, 18 Apr 2022 21:22:41 GMT content-encoding gzip last-modified Mon, 18 Apr 2022 15:17:33 GMT server nginx etag W/"625d810d-b8959" vary Accept-Encoding content-type text/css cache-control max-age=43200 strict-transport-security max-age=31536000 expires Tue, 19 Apr 2022 09:22:41 GMT
GET H2	200	manifest.3ad1d5771e9b13dbdad2.js Show response paypal-account.xyz/static/js/	800 B 1013 B	530ms 529ms	Script application/javascript	5.188.33.171 GHOST
General Check archive.org Show headers Download Go to Full URL https://paypal-account.xyz/static/js/manifest.3ad1d5771e9b13dbdad2.js Requested by Host: paypal-account.xyz URL: https://paypal-account.xyz/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 5.188.33.171 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS facai001.example.com Software nginx / Resource Hash fcdf3becb34727e89ae7395ac70df92e4537639ae903784e201f479dd70f3ef0 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://paypal-account.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers date Mon, 18 Apr 2022 21:22:41 GMT last-modified Mon, 18 Apr 2022 15:17:33 GMT server nginx etag "625d810d-320" strict-transport-security max-age=31536000 content-type application/javascript cache-control max-age=43200 accept-ranges bytes content-length 800 expires Tue, 19 Apr 2022 09:22:41 GMT
GET H2	200	vendor.1335c66d67a2d991e3dd.js Show response paypal-account.xyz/static/js/	4 MB 900 KB	530ms 530ms	Script application/javascript	5.188.33.171 GHOST
General Check archive.org Show headers Download Go to Full URL https://paypal-account.xyz/static/js/vendor.1335c66d67a2d991e3dd.js Requested by Host: paypal-account.xyz URL: https://paypal-account.xyz/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 5.188.33.171 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS facai001.example.com Software nginx / Resource Hash 8d4e8460a070d9e6b9a4cc78092b8b8bfd08fc2552d7ee6c8aff3d0d7aedbb88 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://paypal-account.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers date Mon, 18 Apr 2022 21:22:41 GMT content-encoding gzip last-modified Mon, 18 Apr 2022 15:17:33 GMT server nginx etag W/"625d810d-384ff6" vary Accept-Encoding content-type application/javascript cache-control max-age=43200 strict-transport-security max-age=31536000 expires Tue, 19 Apr 2022 09:22:41 GMT
GET H2	200	app.a47ece9283d64e3572f4.js Show response paypal-account.xyz/static/js/	106 KB 38 KB	530ms 530ms	Script application/javascript	5.188.33.171 GHOST
General Check archive.org Show headers Download Go to Full URL https://paypal-account.xyz/static/js/app.a47ece9283d64e3572f4.js Requested by Host: paypal-account.xyz URL: https://paypal-account.xyz/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 5.188.33.171 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS facai001.example.com Software nginx / Resource Hash 4d632111aaf87e0ba9b9d97ee00cf3bd71e1e2b053e36d4dbc639582494195b1 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://paypal-account.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers date Mon, 18 Apr 2022 21:22:41 GMT content-encoding gzip last-modified Mon, 18 Apr 2022 15:17:33 GMT server nginx etag W/"625d810d-1a8cc" vary Accept-Encoding content-type application/javascript cache-control max-age=43200 strict-transport-security max-age=31536000 expires Tue, 19 Apr 2022 09:22:41 GMT
GET		getiplang admin-qwerasd.live/auth/	0 0
GET H2	200	momgram.png paypal-account.xyz/static/assets/img/	2 KB 2 KB	176ms 176ms	Image image/png	5.188.33.171 GHOST
General Check archive.org Show headers Download Go to Show image Full URL https://paypal-account.xyz/static/assets/img/momgram.png Requested by Host: paypal-account.xyz URL: https://paypal-account.xyz/static/css/app.206b3c99bcd0e426f21e8bd04b1cc7c8.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 5.188.33.171 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS facai001.example.com Software nginx / Resource Hash b3f1bf1d5e25838bcad8535a2b700486644f4ea888e46c77d3e82783cb9da1b4 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://paypal-account.xyz/static/css/app.206b3c99bcd0e426f21e8bd04b1cc7c8.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers date Mon, 18 Apr 2022 21:22:43 GMT last-modified Mon, 18 Apr 2022 15:17:33 GMT server nginx etag "625d810d-6e8" strict-transport-security max-age=31536000 content-type image/png cache-control max-age=2592000 accept-ranges bytes content-length 1768 expires Wed, 18 May 2022 21:22:43 GMT
GET H2	200	sprite_countries_flag4.d3682f0.png paypal-account.xyz/static/img/	71 KB 71 KB	177ms 177ms	Image image/png	5.188.33.171 GHOST
General Check archive.org Show headers Download Go to Show image Full URL https://paypal-account.xyz/static/img/sprite_countries_flag4.d3682f0.png Requested by Host: paypal-account.xyz URL: https://paypal-account.xyz/static/css/app.206b3c99bcd0e426f21e8bd04b1cc7c8.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 5.188.33.171 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS facai001.example.com Software nginx / Resource Hash 9c14b809ca4d5de12a569239d46ab8ef5f7ac1b3804c9801583cbafb66d3e550 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://paypal-account.xyz/static/css/app.206b3c99bcd0e426f21e8bd04b1cc7c8.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers date Mon, 18 Apr 2022 21:22:43 GMT last-modified Mon, 18 Apr 2022 15:17:33 GMT server nginx etag "625d810d-11a80" strict-transport-security max-age=31536000 content-type image/png cache-control max-age=2592000 accept-ranges bytes content-length 72320 expires Wed, 18 May 2022 21:22:43 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

admin-qwerasd.live

URL

https://admin-qwerasd.live/auth/getiplang

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails function| webpackJsonp function| setImmediate function| clearImmediate object| __core-js_shared__

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://admin-qwerasd.live/auth/getiplang Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

admin-qwerasd.live
paypal-account.xyz
admin-qwerasd.live
5.188.33.171
4d632111aaf87e0ba9b9d97ee00cf3bd71e1e2b053e36d4dbc639582494195b1
8d4e8460a070d9e6b9a4cc78092b8b8bfd08fc2552d7ee6c8aff3d0d7aedbb88
9c14b809ca4d5de12a569239d46ab8ef5f7ac1b3804c9801583cbafb66d3e550
b3f1bf1d5e25838bcad8535a2b700486644f4ea888e46c77d3e82783cb9da1b4
b95ed0220d3d50675218aebd526741313505e9127094f37c8f52fa08d432c8b0
d7fc2646d7a225ffe9c349f949afcdc7f45dc2fa75d50265314e85c7828d3ee0
fcdf3becb34727e89ae7395ac70df92e4537639ae903784e201f479dd70f3ef0